CVE-2020-15887

Опубликовано: 23 июл. 2020

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

A SQL injection vulnerability in softwareupdate_controller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary SQL commands via the last URL parameter of the /module/softwareupdate/get_tab_data/ endpoint.

Ссылки

https://github.com/munkireport/munkireport-php/releases
Release Notes
Third Party Advisory
https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3
Release Notes
Third Party Advisory
https://github.com/munkireport/munkireport-php/wiki/20200722-SQL-Injection-in-softwareupdate-module
Third Party Advisory
https://github.com/munkireport/softwareupdate/releases
Release Notes
Third Party Advisory
https://github.com/munkireport/munkireport-php/releases
Release Notes
Third Party Advisory
https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3
Release Notes
Third Party Advisory
https://github.com/munkireport/munkireport-php/wiki/20200722-SQL-Injection-in-softwareupdate-module
Third Party Advisory
https://github.com/munkireport/softwareupdate/releases
Release Notes
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:softwareupdate_project:softwareupdate:*:*:*:*:*:munkireport:*:*

Версия до 1.6 (исключая)

EPSS

Процентиль: 59%

0.00374

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-4qgh-m9vp-48xp